.

wcfs/client/wcfs.cpp

@@ -385,7 +385,6 @@ pair<Mapping, error> _FileH::mmap(int64_t blk_start, int64_t blk_len, VMA *vma)
     xerr::Contextf E("wcfs %s: conn @%s: mmap f<%s> [blk%ld +blk%ld)",
             v(f.wconn->_wc->mountpoint), v(f.wconn->at), v(f.foid), blk_start, blk_len);
 
-    // XXX (blk_start + blk_len) * blk_size overflow
     error err;
 
     if (blk_start < 0)
@@ -393,20 +392,25 @@ pair<Mapping, error> _FileH::mmap(int64_t blk_start, int64_t blk_len, VMA *vma)
     if (blk_len < 0)
         panic("blk_len < 0");
 
-    int64_t blk_stop = blk_start + blk_len;     // XXX overflow
+    int64_t blk_stop; // = blk_start + blk_len
+    if (__builtin_add_overflow(blk_start, blk_len, &blk_stop))
+        panic("blk_start + blk_len overflow int64");
+
+    int64_t stop;//  = blk_stop *f.blksize;
+    if (__builtin_mul_overflow(blk_stop, f.blksize, &stop))
+        panic("(blk_start + blk_len)*f.blksize overflow int64");
+    int64_t start    = blk_start*f.blksize;
 
     // XXX f locking?
 
     // create memory with head/f mapping and applied pins
     // mmap-in zeros after f.size (else access to memory after file.size will raise SIGBUS)
-    int64_t start = blk_start*f.blksize;
     uint8_t *mem_start, *mem_stop;
     tie(mem_start, err) = mmap_ro(f._headf, start, blk_len*f.blksize);
     if (err != nil)
         return make_pair(nil, E(err));
     mem_stop = mem_start + blk_len*f.blksize;
 
-    int64_t stop = blk_stop*f.blksize;
     if (stop > f._headfsize) {
         uint8_t *zmem_start = mem_start + (max(f._headfsize/*XXX -1 ?*/, start) - start);
         err = mmap_zero_into_ro(zmem_start, mem_stop - zmem_start);